skills.rest
kyle9021
kyle9021COMMUNITY
Explore all skills by this author →
GitHub

falcon-setup

Configures and verifies a read-only CrowdStrike Falcon MCP server connection with credential and guardrail checks.

3|1|Updated Sep 1, 2026
Search Tags:#authentication#troubleshooting#setup#mcp server#security guardrails#crowdstrike falcon#api scopes
One-click install
npx skills add https://github.com/kyle9021/fal_con_2026_AI-Powered-Cloud-Security-Ops-Falcon-Mcp --skill falcon-setup-kyle9021
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: falcon-setup
Source: https://github.com/kyle9021/fal_con_2026_AI-Powered-Cloud-Security-Ops-Falcon-Mcp/tree/main/.claude/skills/falcon-setup
Command: npx skills add https://github.com/kyle9021/fal_con_2026_AI-Powered-Cloud-Security-Ops-Falcon-Mcp --skill falcon-setup-kyle9021

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve? Setting up the Falcon MCP harness involves credentials, API scopes, region configuration, and security guardrails, and a misconfigured connection produces empty results that look like correct answers. This Skill walks through first-run setup and diagnoses authentication and configuration failures so the connection is proven before any investigation begins. ## Core Features & Use Cases - Guided first-run setup: Creates the .env credentials file with correct permissions, explains how to create a least-privilege Falcon API client, and validates the configuration with the doctor script. - Authentication diagnosis: Distinguishes wrong-region 403s, revoked clients, malformed credentials, and missing per-capability scopes, which otherwise produce identical symptoms. - Guardrail verification: Confirms the read-only mode and the default-deny PreToolUse hook are both active so write tools stay blocked. - Use Case: A security engineer clones the harness, adds Falcon API credentials, and asks the assistant to verify the setup; the Skill runs the doctor, fixes a wrong-region base URL, confirms guardrails, and proves the connection with a known-answer query. ## Quick Start Set up my Falcon MCP harness and verify the connection, API scopes, and security guardrails are working correctly.

Frequently Asked Questions about falcon-setup

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I set up the Falcon MCP server for the first time?▼

Copy env.example to .env, set permissions to 600, and fill in the Falcon client ID, secret, and region-matched base URL from an API client created in the Falcon console. Then run ./scripts/doctor.sh to validate tooling, credentials, scopes, and guardrails.

Why does Falcon API authentication return a 403 error?▼

A 403 at the token endpoint almost always means FALCON_BASE_URL points at the wrong region, since a valid key aimed at the wrong cloud looks like a bad key. If the region is correct, the client was revoked or the secret was truncated during copying.

Why do Falcon MCP tools return no data?▼

Empty results have three distinct causes: a 403 means a missing API scope, a 404 means the feature is not licensed on the tenant, and a 200 with an empty set is a correct answer. Run ./scripts/doctor.sh to separate these cases before concluding anything.

What API scopes does the Falcon MCP harness need?▼

The harness needs only the READ scopes listed in docs/api-scopes.md, granted to the API client in the Falcon console. The doctor script prints the exact missing scope name when a capability probe returns 403.

How do I verify the Falcon MCP read-only guardrails are active?▼

Run ./scripts/test-guardrail.sh and confirm all checks pass. Then verify FALCON_MCP_READ_ONLY=true is set in .env so write tools are never registered, and that the PreToolUse hook enforces default-deny on non-read verbs.

Related Skills

Explore More Software Engineering Skills→
xalgordxalgord
954

deploying-edr-agent-with-crowdstrike

Deploys and configures CrowdStrike Falcon EDR sensors across Windows, macOS, and Linux endpoints.

Community
Intermediate
knowz-ioknowz-io

kc-telemetry-setup

Configure Sentry and Application Insights telemetry sources with connectivity verification.

Official
Intermediate
devbasexdevbasex
1

document-sources

Record sources for every number, figure, and quotation in business documents.

Official
Intermediate
CrowdStrikeCrowdStrike
24

ui-development

Scaffold React or Vue UI pages with Falcon Foundry theme integration.

Official
Intermediate